On Fri, Nov 11, 2022 at 12:05:03PM +0100, Alexander Sosedkin wrote:
On Fri, Nov 11, 2022 at 11:53 AM Petr Pisar <ppisar(a)redhat.com>
wrote:
> > As a result, more RPM packages will be reproducible:
>
> Where will this reproducibility stop?
Ideally, when it's achieved,
and 100% of Fedora will be reproducible under reprotest =P
Exactly ;) My personal goal is to achieve 100% build reproducibility
for packages and other build artifacts. This Change is just one of the
first steps. Sources of non-reproducibility will be tackled one-by-one
as we find them.
> An RPM package itself carry a build time in its RPM header.
> Are we also going to fake this time in the name of
> reproducibility?
My opinion: yes, please do (%use_source_date_epoch_as_buildtime).
Oh, I'm surprised we don't do this yet. I think we should.
And fake the builder hostname (%_buildhost).
Yes. Maybe the best option is to set it when rebuilding an rpm to the
original value.
And enable back --enable-deterministic-archives in binutils:
(
https://bugzilla.redhat.com/show_bug.cgi?id=1195883).
And do whatever else is necessary to stop shipping binary packages
that users can't reproduce bit-to-bit.
The compile-time setting is a brute hammer that affects too many things.
Instead we should clamp the times inteligently where this makes sense.
https://reproducible-builds.org/docs/archives/ describes the approaches
that Debian took. E.g. for tar they add a --clamp-mtime flag, which
seems a nicer approach. I think we'll want something similar for 'ar'.
Zbyszek